Source-linked AI summary
Robustness via curvature regularization, and vice versa
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Jonathan Uesato, Pascal Frossard
TL;DR
The paper asks how adversarial training changes classifier geometry and whether curvature reduction relates to robustness. It analyzes this relationship theoretically and empirically, then introduces CURE, which directly encourages small curvature and achieves robustness comparable to adversarial training while offering a more efficient alternative.
Problem
Classifiers are vulnerable to adversarial perturbations, while the geometric effects of adversarial training on loss landscapes and decision boundaries are not well understood.
Method
The paper analyzes curvature changes under adversarial training, derives robustness bounds using a quadratic loss approximation, and proposes CURE to encourage small curvature.
Results
CURE significantly improves robustness on CIFAR-10 and SVHN to levels comparable to adversarial training, supporting the relationship between small curvature and robustness.
Takeaways & Limitations
The findings support reducing curvature and promoting local linearity as an effective route to robustness, with CURE providing a more efficient alternative to adversarial training.
Takeaways & Limitations
CURE’s results are slightly worse than adversarial training, possibly because higher-order effects are not captured by the second-order analysis or because hyper-parameters are suboptimal.
Abstract
from arXiv · showhide
State-of-the-art classifiers have been shown to be largely vulnerable to adversarial perturbations. One of the most effective strategies to improve robustness is adversarial training. In this paper, we investigate the effect of adversarial training on the geometry of the classification landscape and decision boundaries. We show in particular that adversarial training leads to a significant decrease in the curvature of the loss surface with respect to inputs, leading to a drastically more "linear" behaviour of the network. Using a locally quadratic approximation, we provide theoretical evidence on the existence of a strong relation between large robustness and small curvature. To further show the importance of reduced curvature for improving the robustness, we propose a new regularizer that directly minimizes curvature of the loss surface, and leads to adversarial robustness that is on par with adversarial training. Besides being a more efficient and principled alternative to adversarial training, the proposed regularizer confirms our claims on the importance of exhibiting quasi-linear behavior in the vicinity of data points in order to achieve robustness.
1. Introduction
The paper examines how adversarial training changes classifier geometry and argues that reduced curvature helps explain improved adversarial robustness. It proposes curvature regularization as an efficient alternative with comparable robustness.
- Motivation: Adversarial training is effective against adversarial perturbations, but its effects on loss landscapes and decision boundaries remain insufficiently understood.The paper frames comparing adversarially trained models with models trained on original data as its central question.
- Geometric effect: Adversarial training significantly decreases curvature in the loss landscape and decision boundaries, producing more locally linear classifier behavior.The analysis treats curvature reduction as a central geometric effect of adversarial training.
- Theory: A quadratic approximation yields upper and lower robustness bounds in terms of loss curvature, supporting a relation between low curvature and high robustness.These bounds provide theoretical evidence connecting local geometry to adversarial robustness.
- Curvature regularization: Curvature Regularization (CURE) directly encourages small curvature and significantly improves robustness on CIFAR-10 and SVHN, reaching levels comparable to adversarial training.The regularizer is presented as a synthesis of the geometric analysis and theoretical bounds.
- Scope and implication: The proposed regularizer is positioned as a more efficient alternative to adversarial training, while the paper primarily focuses on explaining adversarial-training geometry rather than outperforming that method.The introduction explicitly limits the paper’s main focus to geometric analysis.
2. Geometric analysis of adversarial training
The analysis compares original and adversarially fine-tuned ResNet-18 classifiers on CIFAR-10 and SVHN, finding flatter decision boundaries and substantially lower input-loss curvature after fine-tuning.
- Decision boundaries: Fine-tuned networks place decision boundaries farther from datapoints and make their decision regions flatter and more regular.The cross-sections use a plane spanned by the boundary normal r and a random direction v; increased distance corresponds to higher robustness.
- Input-loss curvature: Curvature profiles are computed from the eigenvalues of the Hessian of the loss with respect to input pixels, not network weights.The profiles contain 3072 eigenvalues for 32 × 32 × 3 inputs, and finite differences measure larger-scale neighborhood variation rather than only pointwise curvature.
- Input-loss curvature: Adversarial fine-tuning strongly decreases curvature near datapoints, producing a smoother, more linear-like loss surface than the original network.Small Hessian eigenvalues indicate locally linear behavior and a flatter decision surface; ReLU networks can have exactly zero logit Hessians locally, motivating larger-scale finite differences.
- Attack behavior: Adversarially trained models show similar adversarial accuracies across simple and complex attacks, whereas original networks benefit more from multi-step attacks.The paper attributes the small attack gap after adversarial training to reduced loss curvature, which lets few gradient steps find perturbations.
3. Analysis of the influence of curvature on robustness
Under a local quadratic approximation, the paper relates adversarial robustness to the loss curvature and derives bounds showing that lower curvature supports higher robustness. The bounds depend also on the input gradient, and become exact when that gradient aligns with the direction of largest curvature.
- Quadratic robustness model: The analysis models the loss locally with a quadratic approximation and defines r* as the minimum ℓ2 perturbation that raises the loss to the misclassification threshold.The threshold is t, with c = t − ℓ(x) measuring the remaining loss margin.
- Quadratic robustness model: Theorem 1 bounds the magnitude of r* using the loss gradient, the largest Hessian eigenvalue ν, and its corresponding eigenvector.The result assumes c := t − ℓ(x) ≥ 0 and ν := λmax(H) ≥ 0.
- Curvature–robustness relation: In a one-dimensional illustration, losses with the same value and gradient at x0 reach the misclassification threshold closer to x0 as curvature increases.Thus, increasing curvature corresponds to smaller adversarial examples in the illustrated setting.
- Curvature–robustness relation: The upper and lower robustness bounds decrease as curvature ν increases, supporting a relation between small curvature and high robustness when other parameters remain fixed.Figure 4 illustrates this dependence under fixed gradient-related quantities.
- Gradient dependence: The bounds also decrease with the gradient norm, but small gradients can obscure vulnerability to non-gradient-based or intrinsically small perturbations.The paper therefore distinguishes reduced gradients from genuine robustness.
- Gradient dependence: The bounds become exact when the input gradient is collinear with the largest-curvature eigenvector, a condition observed approximately in practice.For CIFAR-10, the average normalized alignment is 0.43 before and 0.90 after adversarial fine-tuning, versus approximately 0.02 for typical random vectors.
4. Improving robustness through curvature regularization
The paper introduces CURE, a curvature regularizer that approximates Hessian penalties through gradient differences and targets high-curvature directions. Fine-tuning with CURE improves adversarial robustness, produces geometry similar to adversarial training, and is more efficient, though slightly less effective.
- Curvature regularization: CURE penalizes curvature by minimizing gradient differences at nearby points, using a finite-difference approximation to Hessian-vector products.The scale is controlled by h, while γ weights the regularizer relative to the loss.
- Curvature regularization: CURE selects gradient-sign directions as high-curvature directions and imposes gradient regularity rather than minimizing loss on adversarially perturbed points.For ℓ∞ robustness, z is chosen proportional to sign(∇ℓ(x)), constraining the direction to the relevant hypercube.
- Robustness results: 20 epochs of CURE fine-tuning significantly boost adversarial performance, reaching levels comparable to adversarial training under the reported PGD(20) evaluation.The CIFAR-10 evaluation uses perturbations constrained by ℓ∞ norm less than ϵ = 8.
- Efficiency and scope: CURE requires 2 backward passes and fine-tunes a pretrained network, whereas strong adversarial training generally requires around 10 backward passes and starts from scratch.The authors describe CURE as a more efficient alternative, but report slightly worse results than adversarial training.
- Geometry and robustness: CURE and adversarial training produce similar curvature profiles and more linear local loss surfaces, while curvature decreases as adversarial accuracy increases during CURE fine-tuning.The intended global curvature measure ∥H∥F also decreases, supporting ∥Hz∥ as an efficient proxy.
- Qualitative evaluation: CURE yields visually meaningful SVHN adversarial examples whose perturbed images resemble images from the adversary class.The paper notes a similar observation for adversarially trained models.
5. Conclusion
The paper links small curvature with robustness and validates this relationship through CURE, which achieves robustness comparable to adversarial training while encouraging local linearity.
- CURE directly encourages small curvature, providing empirical and theoretical evidence for a strong correlation between curvature and robustness.
- CURE significantly improves deep-network robustness and achieves performance comparable to adversarial training.The authors present it as an efficient alternative to adversarial training.
- The results suggest that improving robustness requires decreasing curvature rather than increasing it.This contrasts with prior work attributing classifier vulnerability to the linearity of deep networks.
A.1. Results of applying CURE on the SVHN dataset
The SVHN appendix evaluates CURE by fine-tuning a ResNet-18 and reports clean and adversarial accuracy under a specified PGD attack.
- CURE is evaluated by fine-tuning a pre-trained ResNet-18 on SVHN for 20 epochs.The learning rate ranges from 10^-4 to 10^-6, with γ set to 4, 8, and 12 across the schedule.
- Table 3 reports clean and adversarial accuracy for original, regularized, and adversarially trained models.The models are evaluated using PGD(10) with ϵ = 12.
A.2. Curvature profile of CURE
Figure 12 presents curvature profiles for an SVHN-trained ResNet-18 before and after fine-tuning with CURE.
- Figure 12 compares curvature profiles for an original SVHN-trained ResNet-18 and its CURE fine-tuned version.
A.3. Loss surface visualization
Figure 13 visualizes the negative loss surfaces of original and CURE fine-tuned SVHN networks across a boundary-normal direction and a random direction.
- Figure 13 plots −ℓ(s) over a plane spanned by a decision-boundary normal direction and a random direction.The original sample is marked by a blue dot; light blue denotes low-loss classification regions, while red denotes high-loss adversarial regions.
A.4. Evolution of curvature and robustness
The CURE fine-tuning analysis tracks curvature estimates and PGD(10) adversarial accuracy over training for a ResNet-18 on SVHN.
- A.4. Evolution of curvature and robustness: Figure 14 tracks the Frobenius norm estimate, ∥Hz∥, and PGD(10) adversarial accuracy during CURE fine-tuning.The adversarial-accuracy measurement uses ϵ = 8, and curves are averaged over 1000 datapoints.
- A.4. Evolution of curvature and robustness: The curvature quantity F is estimated as an empirical expectation of ∥Hz∥2 over 100 Gaussian vectors zi ∼ N(0, I).The expectation is approximated using samples zi ∼ N(0, I).
A.5. Adversarial accuracy
Adversarial accuracy is evaluated across perturbation magnitudes for a CURE-trained ResNet-18 on SVHN using PGD(10).
- A.5. Adversarial accuracy: Figure 15 plots PGD(10) adversarial accuracy against perturbation magnitude ϵ for a CURE-trained ResNet-18 on SVHN.The curve is generated from 2000 random test points.